#!/usr/bin/perl
#
# This is a grievous hack to cope with an interop bug with very old
# versions of Microsoft Exchange.
# http://archives.neohapsis.com/archives/postfix/2013-11/0121.html
#
# The approach is to expand the default cipher list then shuffle
# RC4-SHA up to a position that is early enough that Exchange will see
# it.
#
# $Cambridge: hermes/conf/exim/sbin/fixciphers,v 1.4 2013/11/21 15:10:59 fanf2 Exp $

use warnings;
use strict;

die "usage: fixciphers <outfile>\n" unless @ARGV == 1;
my $ofn = shift;

my @ciphers =
    grep !m{^RC4-SHA$},
    split ":",
    qx{/opt/OpenSSL/bin/openssl ciphers DEFAULT};
die "openssl ciphers failed\n" unless @ciphers > 64;
splice @ciphers, 63, 0, "RC4-SHA";

open my $ofh, ">", $ofn or die "open > $ofn: $!\n";
print $ofh join ":", @ciphers;
